Data Processing Addendum

Last updated: September 26, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between you (the "Customer") and ChatbotReply for the customer-service chatbot platform (the "Service"). Where the Customer is subject to the EU General Data Protection Regulation (GDPR) or the UK GDPR, this DPA applies to ChatbotReply's processing of personal data on the Customer's behalf.

1. Roles

The Customer is the controller of personal data collected through its chatbot (end-customer chat transcripts, captured leads, order details the Customer syncs). ChatbotReply is the processor, processing that data only to provide the Service and only on the Customer's documented instructions (your dashboard settings, API calls, and this DPA).

2. What we process, and why

Data	Purpose
Business profile, FAQs, imported website content, settings	Configuring and running your chatbot
Chat transcripts and session metadata	Generating replies, conversation context, analytics
Captured leads (name, email, phone where you enable capture)	Lead handoff to your team
Synced order data (order numbers, status, items)	Order lookup, cancellation and refund actions
Account contact details (name, email)	Account administration and billing

3. Our commitments as processor

We process personal data only on your instructions and to provide the Service — never for our own purposes.
We never sell personal data and never use your content to train shared AI models.
Access is limited to personnel who need it to operate the Service; admin sessions are scoped to a single business (tenant isolation enforced in code and tested).
Passwords are stored as salted hashes; third-party tokens can be stored encrypted; all traffic runs over HTTPS/TLS.
We will notify you without undue delay (and within 72 hours of becoming aware) if we learn of a personal data breach affecting your data, with the information reasonably needed for your own notification duties.
We will help you respond to data-subject requests (access, correction, export, deletion) — store owners can already delete conversations, leads and documents from the dashboard at any time.

4. Subprocessors

We use the subprocessors listed on our Security & privacy page. We will update that list before engaging a new subprocessor for personal-data processing; continued use of the Service after 30 days' notice constitutes acceptance.

5. International transfers

Data is hosted in the United States (Render, Oregon; Neon, US West). Where GDPR applies, transfers rely on the EU Standard Contractual Clauses, which we will execute with you on request — email privacy@chatbotreply.com.

6. Retention and deletion

We keep your data while your account is active. When you delete your account (Settings → Danger zone in the admin dashboard), we remove your business data within 30 days; backups age out within 90 days. On termination of the Service we will delete or return your data on request within the same windows.

7. Audits

On reasonable written request (no more than once per 12 months), we will answer a security questionnaire or provide a summary of our technical and organizational measures so you can verify compliance with this DPA.

8. Contact

Privacy questions or data requests: privacy@chatbotreply.com — we respond within 30 days.